CVE Intelligence
Analysis AI-assisted

CVE-2026-39531: WP Directory Kit SQL Injection Vulnerability

CVE-2026-39531 is a blind SQL injection flaw (CWE-89) in the WP Directory Kit WordPress plugin, as described by the Patchstack CNA. The record assigns a CVSS 3.1 score of 9.3 (critical) and states that the issue affects versions through 1.5.0. No confirmed exploitation appears in the sources consulted, and the record contains no fixed-version data.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The CNA record describes a blind SQL injection flaw (CWE-89) in the WP Directory Kit WordPress plugin. The record states that the issue affects versions from n/a through 1.5.0.

Impact

  • The CVSS 3.1 score of 9.3 assigned by Patchstack is critical. Its vector indicates a network attack with low complexity, no privileges and no user interaction.
  • The vector reports high confidentiality impact, no integrity impact and low availability impact.
  • Blind SQL injection can allow database contents to be inferred indirectly, which may expose stored data.

Affected products and versions

  • Product: WP Directory Kit, a WordPress plugin.
  • Versions: the record says 'from n/a through 1.5.0'. The lower bound is not specified.
  • The record contains no structured affected or fixed version data.

Exploitation status

  • The record shows the CVE is not listed in the CISA KEV catalog.
  • No confirmed exploitation appears in the sources consulted.
  • The record gives an EPSS probability of 0.004 with a percentile of 0.32402.

Remediation and mitigation

  • Check whether WP Directory Kit is installed and which version is in use. Versions up to and including 1.5.0 are described as affected.
  • Check the Patchstack advisory and the plugin vendor for a fixed release. The record does not provide one.
  • If no fix is available and the plugin is not essential, consider deactivating it.
  • Limit database account privileges to the minimum needed and keep WordPress and other plugins updated.

Detection guidance

  • Review web server and application logs for unusual parameters or database error messages on plugin pages.
  • Watch for unexpected response delays or abnormal request volume to directory pages.
  • Maintain an inventory of sites running the plugin to prioritize review.

Limitations of the available information

  • The record does not identify the vulnerable parameter, endpoint or the user role needed beyond what the CVSS vector implies.
  • The record has no fixed version, vendor advisory text or exploitation details.
  • The lower bound of the affected range is not specified.
  • The record's source status is Deferred, so NVD analysis may be incomplete.

Frequently asked questions

Which versions of WP Directory Kit are affected by CVE-2026-39531?

The record says the issue affects versions from n/a through 1.5.0. The lower bound is not specified, and the record contains no structured version data.

Is CVE-2026-39531 known to be exploited?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Is there a fixed version available?

The record does not provide a fixed version. Check the Patchstack advisory and the plugin vendor for updates.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.